Skip to content

Conversation

Carglglz
Copy link
Contributor

This enables date/time certificate validation for UNIX, STM32* and MIMXRT* ports.

I'm not sure if in STM32 or MIMXRT ports work (I have not tested it since I do not have the required hardware) but if that is not the case it should be close (I hope).

The problem with these two ports is that they do not include <time.h> which is required for MBED_TLS_HAVE_TIME_DATE to work. From mbedtls config.h

* \def MBEDTLS_HAVE_TIME_DATE
* System has time.h, time(), and an implementation for
 * mbedtls_platform_gmtime_r() (see below).
 * The time needs to be correct (not necessarily very accurate, but at least
 * the date should be correct). This is used to verify the validity period of
 * X.509 certificates.
 *
 * Comment if your system does not have a correct clock.
 *
 * \note mbedtls_platform_gmtime_r() is an abstraction in platform_util.h that
 * behaves similarly to the gmtime_r() function from the C standard. Refer to
 * the documentation for mbedtls_platform_gmtime_r() for more information.
 *
 * \note It is possible to configure an implementation for
 * mbedtls_platform_gmtime_r() at compile-time by using the macro
 * MBEDTLS_PLATFORM_GMTIME_R_ALT.
 */

The solution is to use this macro MBEDTLS_PLATFORM_GMTIME_R_ALT

/**
 * Uncomment the macro to let Mbed TLS use your alternate implementation of
 * mbedtls_platform_gmtime_r(). This replaces the default implementation in
 * platform_util.c.
 *
 * gmtime() is not a thread-safe function as defined in the C standard. The
 * library will try to use safer implementations of this function, such as
 * gmtime_r() when available. However, if Mbed TLS cannot identify the target
 * system, the implementation of mbedtls_platform_gmtime_r() will default to
 * using the standard gmtime(). In this case, calls from the library to
 * gmtime() will be guarded by the global mutex mbedtls_threading_gmtime_mutex
 * if MBEDTLS_THREADING_C is enabled. We recommend that calls from outside the
 * library are also guarded with this mutex to avoid race conditions. However,
 * if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, Mbed TLS will
 * unconditionally use the implementation for mbedtls_platform_gmtime_r()
 * supplied at compile time.
 */
//#define MBEDTLS_PLATFORM_GMTIME_R_ALT

So I tried to implement this function in both ports following modutime.c but not sure if it would work as expected. If anyone with the required hardware could do a test, it would be nice. 👍🏼

For ESP32 port I have a working solution in #8968 , but it cannot be implemented yet I guess.

@Carglglz Carglglz marked this pull request as ready for review August 23, 2022 19:57
@dpgeorge dpgeorge added the extmod Relates to extmod/ directory in source label Aug 25, 2022
@Carglglz Carglglz closed this Jun 30, 2023
@Carglglz Carglglz deleted the ssl-cert-time-verify branch January 21, 2024 17:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
extmod Relates to extmod/ directory in source
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants